CVE-2022-39197

CVE-2022-39197 affects HelpSystems Cobalt Strike Team Server up through version 4.7, where a cross-site scripting vulnerability in the Teamserver enables an attacker to influence the Beacon configuration by supplying a malformed username in payloads. The public data describe several PoCs and expl...

CVE-2022-42948

CVE-2022-42948 affects Cobalt Strike 4.7.1, due to improper escaping of HTML in Swing components, enabling remote code execution in the Cobalt Strike UI when crafted HTML is injected. The NVD indicates a critical CVSS v3.1 score (9.8) with network attack vector and no privileges/user interaction ...

CVE-2021-36798

CVE-2021-36798 affects HelpSystems Cobalt Strike Team Server (versions 4.2 and 4.3). The DoS arises when a beacon registers with the C2/Team Server, enabling a remote attacker to crash the C2 server thread and disrupt beacon communications. Publicly available exploit/ PoC details exist (e.g., a G...

CVE-2022-23317

CVE-2022-23317 concerns the Cobalt Strike HTTP(S) listener. The root cause is that the listener fails to determine whether the request URL begins with a “/”, allowing an attacker to obtain information by crafting the URL. Affected: Cobalt Strike versions